Users Guide

• Within a port, you can apply Layer 2 ACLs on a VLAN or a set of VLANs. In this case, CAM optimization is
not applied.
• To enable optimization of CAM space for Layer 2 or Layer 3 ACLs that are applied to ports, the port
number is removed as a qualifier for ACL application on ports, and port bits are used. When you apply
the same ACL to a set of ports, the port bitmap is set when the ACL flow processor (FP) entry is added.
When you remove the ACL from a port, the port bitmap is removed.
• If you do not attach an ACL to any of the ports, the FP entries are deleted. Similarly, when the same ACL
is applied on a set of ports, only one set of entries is installed in the FP, thereby saving CAM space.
Enable optimization using the optimized option in the ip access-group command. This option is not
valid for VLAN and link aggregation group (LAG) interfaces.
Configuring ACL VLAN Groups and
Configuring FP Blocks for VLAN
Parameters
This section describes how to optimize CAM blocks by configuring ACL VLAN groups that you can attach to
VLAN interfaces. It also describes how to configure FP blocks for different VLAN operations.
Configuring ACL VLAN Groups
You can create an ACL VLAN group and attach the ACL with the VLAN members. The optimization is
applicable only when you create an ACL VLAN group.
1 Create an ACL VLAN group.
CONFIGURATION mode
acl-vlan-group {group name}
You can have up to eight different ACL VLAN groups at any given time.
2 Add a description to the ACL VLAN group.
CONFIGURATION (conf-acl-vl-grp) mode
description description
3 Apply an egress IP ACL to the ACL VLAN group.
CONFIGURATION (conf-acl-vl-grp) mode
ip access-group {group name} out implicit-permit
4 Add VLAN member(s) to an ACL VLAN group.
CONFIGURATION (conf-acl-vl-grp) mode
member vlan {VLAN-range}
5 Display all the ACL VLAN groups or display a specific ACL VLAN group, identified by name.
CONFIGURATION (conf-acl-vl-grp) mode
Access Control List (ACL) VLAN Groups and Content Addressable Memory (CAM) 130